From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Alvaro Neira Ayuso <alvaroneay@gmail.com>
Cc: netfilter-devel@vger.kernel.org, kaber@trash.net
Subject: Re: [nft PATCH 2/2 v3] evaluate: reject: check in bridge and inet the network context in reject
Date: Fri, 24 Oct 2014 12:04:56 +0200 [thread overview]
Message-ID: <20141024100456.GD4806@salvia> (raw)
In-Reply-To: <1413984353-16029-2-git-send-email-alvaroneay@gmail.com>
On Wed, Oct 22, 2014 at 03:25:53PM +0200, Alvaro Neira Ayuso wrote:
> In Inet tables, we have to check the network context in rules that we use
> icmp or icmpv6 reason in reject. To be sure that the context is the correct.
> However, for icmpx and tcp reject, we don't need to check it.
>
> In Bridge tables, ee have vlan and arp traffic and they are not supported.
> For this things, we have to check the network context. For example:
>
> nft add rule bridge test-bridge input \
> ether type arp reject with icmp type host-unreachable
> or
> nft add rule bridge test-bridge input \
> ether type vlan reject with tcp reset
>
> In that cases, we have to throw an error. Moreover, we have to accept rules
> that the network context is Ipv4 and Ipv6. For example:
>
> nft add rule -nnn bridge test-bridge input \
> ip protocol tcp reject with tcp reset
>
> Moreover, this patch refactor the code for check the family for bridge and inet
> tables.
Applied, thanks.
next prev parent reply other threads:[~2014-10-24 10:03 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-10-22 13:25 [nft PATCH 1/2 v3] evaluate: reject: accept a reject reason with incorrect network context Alvaro Neira Ayuso
2014-10-22 13:25 ` [nft PATCH 2/2 v3] evaluate: reject: check in bridge and inet the network context in reject Alvaro Neira Ayuso
2014-10-24 10:04 ` Pablo Neira Ayuso [this message]
2014-10-24 10:04 ` [nft PATCH 1/2 v3] evaluate: reject: accept a reject reason with incorrect network context Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20141024100456.GD4806@salvia \
--to=pablo@netfilter.org \
--cc=alvaroneay@gmail.com \
--cc=kaber@trash.net \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.